Solicitation.pdf

SEE ADDENDUM

(No Collect Calls)

W81K0020Q0186 22-Jul-2020

b. TELEPHONE NUMBER

210-221-4820

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 29 Jul 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W81K009. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

KIMBERLY R. MACIAS

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011504424

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

W40M USA HLTH CONTRACTING ACT

REGIONAL HEALTH CONTRACT OFF CENTRAL

2539 GARDEN AVENUE

FT SAM HOUSTON TX 78234-0000

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W45NSV 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

X SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

WILLIAM BEAUMONT ARMY MEDICAL CENTER

WILLIAM BEAUMONT ARMY MEDICAL CENTE

BLDG 7777 ROOM 1-067, 5005 N. PIEDRAS

EL PASO TX 79920

TEL: FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

1,000

NAICS:

339112

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF66

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W81K0020Q0186

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

RMF Process

FFP

RMF Process at no cost to the Government.

VENDOR PART NR: RMF Process

NET AMT

0002 2 Each

HEMOSTATIS ANALYZER

FFP

INCLUDES: UL HOSPITAL GRADE POWER CORD 110V/60 HZ, USER AND

ADMINISTRATIVE MANUALS, SMS CD-ROM. PROJECT MANAGEMENT

AND TECHNICAL SUPPORT IMPLEMENTATION. CLINICAL TRAINING.

FOB: Destination

PURCHASE REQUEST NUMBER: 0011504424

PSC CD: 6515

0003 1 Each

MANAGER LICENSE FEE

FFP

NUMBER OF SOFTWARE LICENSE INSTALLATIONS NEEDED. THE

NUMBER OF INSTALLATIONS SELECTED REFLECTS THE NUMBER OF

LICENSES OR ADDITIONAL DATABASES REQUIRED. 50 CONCURRENT

USERS.

FOB: Destination

0004 1 Each

MANAGER SOFTWARE SUPPORT AND MAINTENANCE

FFP

INCLUDES: STANDARD CUSTOMER SUPPORT PLUS SOFTWARE

UPDATES PROJECT MANAGEMENT AND TECHNICAL SUPPORT

IMPLEMENTATION TECHNICAL SERVICES EDUCATION

FOB: Destination

0005 1 Each

INTERPRETATION GUIDANCE MODULE

FFP

INTERPRETATION GUIDANCE MODULE

FOB: Destination

0006 1 Each

IMPLEMENTATION SERVICES

FFP

IMPLEMENTATION SERVICES

FOB: Destination

0007 2 Each

BARCODE SCANNER

FFP

BARCODE SCANNER

FOB: Destination

0008 2 Each

THERMAL PRINTER

FFP

THERMAL PRINTER

FOB: Destination

0009 1 Each

VALIDATION

FFP

VALIDATION CALCULATION AND LETTER OF PERFORMANCE

FOB: Destination

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 N/A N/A N/A N/A

0002 POP 03-AUG-2020 TO

02-FEB-2021

N/A WILLIAM BEAUMONT ARMY MEDICAL

CENTER

WILLIAM BEAUMONT ARMY MEDICAL

CENTE

BLDG 7777 ROOM 1-067, 5005 N. PIEDRAS

EL PASO TX 79920

FOB: Destination

W45NSV

0003 POP 03-AUG-2020 TO

02-FEB-2021

N/A (SAME AS PREVIOUS LOCATION)

0004 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

0005 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

0006 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

0007 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

0008 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

0009 POP 03-AUG-2020 TO

N/A (SAME AS PREVIOUS LOCATION)

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 N/A N/A N/A N/A 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0007 Destination Government Destination Government 0008 Destination Government Destination Government 0009 Destination Government Destination Government

SALIENT CHARACTERISTICS

a. Must provide clear, accurate, precise thromboelastographic assessment

b. Must be portable, light weight, point-of-care test utilizing testing multi-channel cartridges

c. Easy quality control protocol

d. Must provide real-time results within minutes

e. Real-time Data with manager software

f. LCD touch screen color monitor minimum of 6.5”with user interface capabilities

g. Data storage for educational training

h. User login security utilizing username and password login

i. FDA approved for a multitude of applications including trauma and CT surgery

j. Ability to print results or view in real time with computer application

k. Ethernet and USB connections for data storage and interface with WBAMC Electronic Medical

Record (EMR).

l. Vendor must agree to comply with the DHA Information Assurance (IA) requirements as identified as “Defense Health Agency (DHA) Cyber Logistics (CyberLOG) Cybersecurity/Risk Management Framework (RMF) Requirements (dated 02-07-2019)”.

m. Must be able to obtain an approved Authority to Operate (AT0)

n. Multi-channel cartridges

o. System that is capable of providing results using sample of blood volume

p. Technical Support and Service included with Warranty

q. Disinfecting protocol easy to follow

r. Wireless/Bluetooth Capable

s. Solid state hard drive, application-specific presets

t. High-resolution, LCD monitor, with anti-glare screen

u. Vibration resistant

v. Global hemostasis and platelet mapping capabilities

w. Self-contained system

x. Must provide digital and hardcopy of user and operator manual upon delivery of device.

y. Onsite training for clinical staff and engineering training

(END)

RMF REQUIREMENT

A. GENERAL OVERVIEW OF ARMY CYBERSECURITY REQUIREMENTS

1. New Equipment/Product systems, equipment and software under RMF: The vendor shall agree to comply with References listed in Appendix A.

Software patches and updates: Many enterprises within the DoD automate patch updates and software updates for operating systems and DoD standard software applications. For applications such as databases and developed applications, updates are scheduled. Software updates will be analyzed by the Government to determine if reauthorization is required by Department of Defense Instruction (DoDI)

8510.01 Risk Framework (FMF) for DoD Information Technology (IT). Patches normally address bug fixes and cybersecurity issues. Applying patches usually does not trigger reauthorization. Per the DoDI

8500.01 Cybersecurity, Enclosure 3, paragraph 9.b. (11), “All IA products and IA-enabled products that require use of the product’s IA capabilities will comply with the evaluation and validation requirements of Committee on National Security Systems Policy 11, National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology Products, June 2013, as amended.”

Vendors shall comply with the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS) evaluation (https://www.niap-ccevs.org) which is published on the NIAP-CCEVS Products Compliance List. The NIAP-certified products have been assessed from a security perspective, helping to reduce the existence of potential vulnerabilities.

Vendors are required to continually maintain their products, mitigating vulnerabilities and distributing fixes to licensed users.

Reauthorization in accordance with DoD RMF requirements: Per DoDI 8510.01, Enclosure 6, para 2.f.(6).(a), “In accordance with Appendix III of OMB Circular A-130, systems must be reassessed and reauthorized every 3 years or as a result of a system update that negatively affects the security posture (whichever is less).” Program Offices or appropriate logistics organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization.

The vendor shall maintain all equipment/product versions provided pursuant to this contract, to include the supported operating system, by issuing patches/updates to mitigate vulnerabilities [e.g., Information Assurance Vulnerability Alerts (IAVA) or Information Assurance Vulnerability Bulletins (IAVB)] and network security configurations [e.g., Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)]. The vendor must adhere to DoD and Army guidance for remediation or mitigation of vulnerabilities associated with the equipment/product.

Vendors shall be responsible for providing maintenance support until the end of life date of the equipment identified by the vendor. The vendor shall include, in its pricing to the Government the cost of patching their equipment throughout its lifecycle.

Maintenance and upgrades: Vendors shall agree to the Army Cybersecurity requirements as outlined in this document for all systems and medical devices.

B. Army Cybersecurity/Risk Management Framework (RMF) Requirements

1. System Security Requirements

1.1. The vendor shall submit to the Government, included in the offer/quote, all sections of the Medical Device Cybersecurity Assessment (Questionnaire), which is provided by the government.

Additionally, a vulnerability assessment/report is required from a NESSUS scanner as this is the DoD standard, and Vendors must provide a NESSUS scan prior to award and throughout performance.

1.2. Vendor agrees to comply with security regulations and guidance listed in Appendix A:

Cybersecurity Regulations and Guidance and all RMF requirements.

1.3. Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

1.4. The vendor device or system shall pass pre-validation technical screening (vulnerability scans utilizing NESSUS, and SCAP scans), administered within six (6) months of contract award that will be conducted by the Government , and must meet the criteria listed below (the pre-validation screening is done by the government as a government review, but the technical scans, etc. are provided by the vendor):

1.4.1. No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.2. No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.3. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.4.4. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.5. .The government will provide templates of all requested technical documentation no later than 20 days from Date of Order. The Vendor shall remit all requested technical documents to the requestor no later than 130 days from the Date of Order.

1.6. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the RMF Assessment process according to the associated Plan of Action & Milestone (POA&M).

1.7. The vendor shall provide a Point of Contact (POC) responsible for the cybersecurity of the vendor device or system, throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials outlined in the chart in paragraph 2.

1.8. For all equipment requiring a full Independent Verification and Validation (IVV) test, the vendor shall not make any delivery and shall not receive payment for the system until the Program Management Office (PMO) has completed a self-assessment, and the IVV has been scheduled.

IVV cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POA&Ms must have been identified, and been appropriately mitigated to reduce the risk to the Government network and PHI/PII/FOUO data housed within the system. Delivery may take place prior to this milestone (IVV scheduling) only if written permission is provided by the Contracting Officer.

1.9. For all equipment requiring an Assess Only certification, the vendor shall not make any delivery and shall not receive payment for the system until the PMO has completed a self-assessment, and the system has been submitted for an Assess Only ATO/APL. Submission cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POAMs must have been identified, and been appropriately mitigated to reduce the risk to the Government network and PHI/PII/FOUO data housed within the system. Delivery may take place prior to this milestone only if written permission is provided by the Contracting Officer.

1.10. The vendor shall obtain a recommendation of ATO from a Government-appointed third party validator within twelve (12) months of contract award for technologies processed through an Assessment & Authorization (A&A). Additionally, the vendor shall obtain an authorization from a Government official to be added to an APL for systems/devices processed through an RMF Assess Only.

1.11. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMAs), the vendor shall, after the issuance of an ATO or APL approval, ensure that the vendor’s device or system maintains its ATO or operating system platform and patches/updates for as long as the vendor commercially supports the equipment/product.

The vendor shall maintain an ATO or APL approval on all equipment/product versions owned by the Army and originally purchased through the vendor’s contract. If a vendor cannot support the ATO or APL approval for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO or APL approval, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. During the period of time the vendor has a product installed on the network, the vendor shall provide all required cybersecurity patches/updates. Maintaining the RMF ATO or APL approval shall be included as part of the vendor’s warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly, or implemented by the manufacturer’s technical staff, dependent on the Service Agreement processes.

1.12. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.13. The vendor shall notify the PMO and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address any vulnerabilities in question.

1.14. The vendor shall contact the IA/RMF Office Representative, no later than five (5) business days after delivery order issuance or contract award, to start the process. Failure to do so would be considered a vendor-caused delay.

2. RMF Assessment Timeframes

The following table provides an overview of the entire process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the “Number of Days After Date of Order” column noted below and be completed in the number of days listed below in the “Duration (Days)” column.

ID Step Name (Action or Deliverable

Duration (Days) Number of Days After

Date of Order

Responsible Party

1 1 Categorization 22 Total Days 2 1.1 Vendor RMF Kickoff

Meeting (Vendor must contact the RMF Office Rep)

1 5 GOVERNMENT

3 1.2 SAFE/EDMS Paperwork and Account Creation (If applicable)

10 5 GOVERNMENT

4 1.3 EDMS Functionality Briefing (If applicable)

1 5 GOVERNMENT

5 1.4 Documentation Templates to Vendor

1 5 GOVERNMENT

6 1.5 Hardware/Software Document Production

5 5 VENDOR

7 1.6 STIG Review 2 10 GOVERNMENT 8 1.7 System Categorization 2 12 GOVERNMENT 9 1.8 Categorization Memo

Approval

5 17 GOVERNMENT

10 1.9 Security Assessment Plan Creation*

3 12 GOVERNMENT

11 1.10 SAP Sent to Vendor* 0 15 GOVERNMENT 12 1.11 Contact 3rd Party

IV&V*

0 15 GOVERNMENT

13 2.Control Selection 6 Total Days 14 2.1 System eMASS

Registration

1 12 GOVERNMENT

15 2.2 eMASS Control Selection

1 12 GOVERNMENT

16 2.3 Implementation Plan Completion

5 17 GOVERNMENT

17 3. Implementation 130 Total Days 18 3.1 Documentation Creation and Review

GOVERNMENT

19 3.1.1 Vendor Control and Artifact Documentation

90 5 VENDOR

20 3.1.2 PMO Control Documentation

55 40 GOVERNMENT

21 3.1.3 Documentation 100% Complete (Confirm IV&V*) (If applicable)

0 95 GOVERNMENT

22 3.2 Scanning 120 16 VENDOR 23 3.2.1 Vendor Initial Scan 10 16 VENDOR 24 3.2.2 PMO Review of scans and Vulnerability Report

2 26 GOVERNMENT

25 3.2.3 Vendor Technical Remediation

110 27 VENDOR

26 3.3 DHA Registration* (If applicable)

60 77 GOVERNMENT

27 3.3.1 DHA A&A Request* (If applicable)

1 77 GOVERNMENT

28 3.3.2 Submit Security Plan for Approval

10 77 GOVERNMENT

29 3.4 Submission to IV&V Team/Submit IV&V Request

0 137 GOVERNMENT

through Portal* (If applicable)

30 4. Assess 65 Total Days

31 4.1 Packet Review by IV&V Team or PMO

29 138 GOVERNMENT

32 4.2 Coordination Meeting* 0 165 GOVERNMENT 33 4.3 Onsite IV&V/Package

Validation Review

5 168 GOVERNMENT

34 4.4 SCA-V Packet Review 30 173 GOVERNMENT 35 4.5 SCA-V SAR Issuance 0 203 GOVERNMENT 36 5. Packet Authorization 60 Total Days 38 5.1 Vendor Remediation 30 173 VENDOR

5.1.1 SAR

Review/Concurrence

10 203 GOVERNMENT

39 5.2 Submit to SCAR 10 213 GOVERNMENT 40 5.3 Submit to SCA 5 223 GOVERNMENT 41 5.4 Submit to AO (If applicable)

5 228 GOVERNMENT

42 5.5 AO signature (If applicable)

0 233 GOVERNMENT

Note: *RMF workflow task omitted during the Assess Only Process Note: Not all above actions occur in a sequential manner, as some actions may be worked concurrently.

3. Assessment and Authorization (A&A)

3.1. The vendor shall provide hardware/software lists, architecture drawings, and workflow drawings within 10 business days after contract award. The vendor shall submit all other RMF-required documentation for review and approval, no later than four (4) months after receipt of the templates provided by the Government.

3.2. The vendor shall obtain approval from the Government for any vendor-developed RMF policies, plans, and procedures, prior to implementation.

3.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of a request by the Government.

3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

3.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted or the product is added to the APL.

3.6. The vendor shall ensure that their device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and anti-malware applications that are approved at the time of the ATO or APL issuance. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the vendor device or system. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a POA&M describing steps towards compliance with this requirement.

3.7. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

4. Privileged User Training and Certification Requirements

If a vendor requires a Business-To-Business (B2B), access, etc. to government networks to maintain, analyze, etc., their equipment/product, they must adhere to the following requirements:

Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

• Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01- M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT Level I) and be required to meet minimum Professional Baseline certifications at the time of the contract award. Contractors will be given six

(6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

• Background Investigation. NACI or above is required. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

• Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

• Computer Environment (CE) Certification. The CE certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are required to have a Microsoft 2008 server or 2012 server certification. Contractors working on end-user devices are required to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

• IA Training Requirements. Contractors will meet minimum training requirements within six (6) months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

• Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card (CAC).

• Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php

• Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the facility Provost Marshall Office in conjunction with the facility Information Management Departmen (for contractors requiring on-site access), or through the

Information Assurance/Cyber Security Branch (for contractors requiring remote access to an Army network). Remote access must be through a Defense Health Agency (DHA) B2B solution.

Vendors must email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

• The IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

• Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted an Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements

1. Continuous Risk Management

1.1. Using a laboratory environment, the vendor shall be able to duplicate all fielded equipment/product that falls under the accreditation boundary. The vendor shall ensure that all fielded equipment/product falling under one authorization is tested to maintain the ATO or approved products for as long as the vendor commercially supports the equipment/product.

For each version owned by the Army and originally purchased through the vendor’s contract, the vendor will ensure that each component within the authorization boundary is represented in the test group.

1.2. The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

1.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO or addition to the approved products list. Vendor shall support reauthorizations due to major upgrades.

1.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

1.5. The vendor shall ensure any new deployment (including rebuilds) deploys with a fully-patched, accredited version.

1.6. The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

1.7. The vendor shall provide vulnerability and configuration scan results to the Government on a monthly basis. The vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

1.8. The vendor shall close all discovered vulnerabilities within three (3) months of discovery, or provide a POAM describing how they will work to close the vulnerability.

1.9. The vendor shall submit to the Government for approval, all mitigation plans that addresses any open vulnerabilities.

1.10. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

1.11. The vendor shall use the Government-approved method for remote access administration (DISA B2B) of the system or device.

Appendix A: Cybersecurity Regulations and Guidance

1) Cybersecurity Regulations and Guidance

The vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(b) Office of Management and Budget (OMB)

The following publications are located at https://www.whitehouse.gov/omb/agency/default

(i) Circular A-130

(ii) Guidance M-05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

(c) National Institute of Standards and Technology (NIST) The following publications are located at http://www.nist.gov/publication-portal.cfm

(i) NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management

Framework (RMF) to Federal Information Systems

(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and

Information System View

(iii) NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations

(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and

Information Systems to Security Categories

(d) Federal Information Processing Standards (FIPS) The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic

Modules

(ii) FIPS PUB 199 – Standards for Security Categorization of Federal Information and

Information Systems

(iii) FIPS PUB 200: Minimum Security Requirements for Federal Information and

Information Systems

(iv) FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

(e) Department of Defense (DoD) The following publications are located at http://www.dtic.mil/whs/directives/

(i) DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

(ii) DoD Instruction 8500.1, Cybersecurity

(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK)

Enabling

(iv) DoD Instruction 8510.01, Risk Management Framework Process (RMF)

(v) DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in

DoD Health Care Programs

(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in

DoD Health Care Programs

(viii) DoD Directive 5400.11, DoD Privacy Program

(END)

CLAUSES INCORPORATED BY REFERENCE

52.212-4 Contract Terms and Conditions--Commercial Items OCT 2018

52.212-4 ADDENDUM

The Government may make unilateral modifications considered administrative in nature. These include, but are not limited to, changes in the accounting and appropriation data, payment and issuing office addresses, and other corrections that have no effect on the terms and conditions of the contract.

(v) The non-FAR Part 12 discretionary FAR, DFARS, AFARS, and LOCAL clauses included herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 herein for locations where full text can be found.

CLAUSES INCORPORATED BY REFERENCE

52.219-6 Notice Of Total Small Business Set-Aside MAR 2020 52.222-19 Child Labor -- Cooperation with Authorities and Remedies JAN 2020 52.222-50 Combating Trafficking in Persons JAN 2019 52.223-18 Encouraging Contractor Policies To Ban Text Messaging

While Driving

JUN 2020

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.232-33 Payment by Electronic Funds Transfer--System for Award

Management

OCT 2018

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.225-7048 Export-Controlled Items JUN 2013

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006

CLAUSES INCORPORATED BY FULL TEXT

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations. (NOV 2015)

(a) Definitions. As used in this clause--

Inverted domestic corporation means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

Subsidiary means an entity in which more than 50 percent of the entity is owned--

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

(b) If the contractor reorganizes as an inverted domestic corporation or becomes a subsidiary of an inverted domestic corporation at any time during the period of performance of this contract, the Government may be prohibited from paying for Contractor activities performed after the date when it becomes an inverted domestic corporation or subsidiary. The Government may seek any available remedies in the event the Contractor fails to perform in accordance with the terms and conditions of the contract as a result of Government action under this clause.

(c) Exceptions to this prohibition are located at 9.108-2.

(d) In the event the Contractor becomes either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation during contract performance, the Contractor shall give written notice to the Contracting Officer within five business days from the date of the inversion event.

(End of clause)

52.219-28 POST-AWARD SMALL BUSINESS PROGRAM REREPRESENTATION (MAY 2020)

(a) Definitions. As used in this clause--

Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to Extend Services, or other appropriate authority.

Small business concern means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (d) of this clause. Such a concern is ``not dominant in its field of operation'' when it does not exercise a controlling or major influence on a national basis in a kind of business activity in which a number of business concerns are primarily engaged. In determining whether dominance exists, consideration shall be given to all appropriate factors, including volume of business, number of employees, financial resources, competitive status or position, ownership or control of materials, processes, patents, license agreements, facilities, sales territory, and nature of business activity.

(b) If the Contractor represented that it was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall rerepresent its size and socioeconomic status according to paragraph (f) of this clause or, if applicable, paragraph (h) of this clause, upon occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts--

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) If the Contractor represented that it was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall rerepresent its size and socioeconomic status according to paragraph (f) of this clause or, if applicable, paragraph (h) of this clause, when the Contracting Officer explicitly requires it for an order issued under a multiple-award contract.

(d) The Contractor shall rerepresent its size status in accordance with the size standard in effect at the time of this rerepresentation that corresponds to the North American Industry Classification System (NAICS) code(s) assigned to this contract. The small business size standard corresponding to this NAICS code(s) can be found at https://www.sba.gov/document/support--table-size-standards.

(e) The small business size standard for a Contractor providing a product which it does not manufacture itself, for a contract other than a construction or service contract, is 500 employees.

(f) Except as provided in paragraph (h) of this clause, the Contractor shall make the representation(s) required by paragraph (b) and (c) of this clause by validating or updating all its representations in the Representations and Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The Contractor shall notify the contracting office in writing within the timeframes specified in paragraph (b) of this clause, or with its offer for an order (see paragraph (c) of this clause), that the data have been validated or updated, and provide the date of the validation or update.

(g) If the Contractor represented that it was other than a small business concern prior to award of this contract, the Contractor may, but is not required to, take the actions required by paragraphs (f) or (h) of this clause.

(h) If the Contractor does not have representations and certifications in SAM, or does not have a representation in SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following rerepresentation and submit it to the contracting office, along with the contract number and the date on which the rerepresentation was completed:

(1) The Contractor represents that it [X] is, [ ] is not a small business concern under NAICS Code 339112 assigned to contract number TBD.

(2) [Complete only if the Contractor represented itself as a small business concern in paragraph (h)(1) of this clause.] The Contractor represents that it [ ] is, [ ] is not, a small disadvantaged business concern as defined in 13 CFR 124.1002.

(3) [Complete only if the Contractor represented itself as a small business concern in paragraph (h)(1) of this clause.] The Contractor represents that it [ ] is, [ ] is not a women-owned small business concern.

(4) Women-owned small business (WOSB) concern eligible under the WOSB Program. [Complete only if the Contractor represented itself as a women-owned small business concern in paragraph (h)(3) of this clause.] The Contractor represents that--

(i) It [ ] is, [ ] is not a WOSB concern eligible under the WOSB Program, has provided all the required documents to the WOSB Repository, and no change in circumstances or adverse decisions have been issued that affects its eligibility; and

(ii) It [ ] is, [ ] is not a joint venture that complies with the requirements of 13 CFR part 127, and the representation in paragraph (h)(4)(i) of this clause is accurate for each WOSB concern eligible under the WOSB Program participating in the joint venture.

[The Contractor shall enter the name or names of the WOSB concern eligible under the WOSB Program and other small businesses that are participating in the joint venture: .] Each WOSB concern eligible under the WOSB Program participating in the joint venture shall submit a separate signed copy of the WOSB representation.

(5) Economically disadvantaged women-owned small business (EDWOSB) concern. [Complete only if the Contractor represented itself as a women-owned small business concern eligible under the WOSB Program in (h)(4) of this clause.] The Contractor represents that--

(i) It [ ] is, [ ] is not an EDWOSB concern eligible under the WOSB Program, has provided all the required documents to the WOSB Repository, and no change in circumstances or adverse decisions have been issued that affects its eligibility; and

(ii) It [ ] is, [ ] is not a joint venture that complies with the requirements of 13 CFR part 127, and the representation in paragraph (h)(5)(i) of this clause is accurate for each EDWOSB concern participating in the joint venture. [The Contractor shall enter the name or names of the EDWOSB concern and other small businesses that are participating in the joint venture: .] Each EDWOSB concern participating in the joint venture shall submit a separate signed copy of the EDWOSB representation.

(6) [Complete only if the Contractor represented itself as a small business concern in paragraph (h)(1) of this clause.] The Contractor represents that it [ ] is, [ ] is not a veteran-owned small business concern.

(7) [Complete only if the Contractor represented itself as a veteran-owned small business concern in paragraph (h)(6) of this clause.] The Contractor represents that it [ ] is, [ ] is not a service-disabled veteran-owned small business concern.

(8) [Complete only if the Contractor represented itself as a small business concern in paragraph (h)(1) of this clause.] The Contractor represents that--

(i) It [ ] is, [ ] is not a HUBZone small business concern listed, on the date of this representation, on the List of Qualified HUBZone Small Business Concerns maintained by the Small Business Administration, and no material changes in ownership and control, principal office, or HUBZone employee percentage have occurred since it was certified in accordance with 13 CFR part 126; and

(ii) It [ ] is, [ ] is not a HUBZone joint venture that complies with the requirements of 13 CFR part 126, and the representation in paragraph (h)(8)(i) of this clause is accurate for each HUBZone small business concern participating in the HUBZone joint venture. [The Contractor shall enter the names of each of the HUBZone small business concerns participating in the HUBZone joint venture: .] Each HUBZone small business concern participating in the HUBZone joint venture shall submit a separate signed copy of the HUBZone representation.

[Contractor to sign and date and insert authorized signer's name and title.]

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): https://acquisition.gov

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT

REPORTING (DEC 2019)

(a) Definitions. As used in this clause--

Adequate security means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

Contractor attributional/proprietary information means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

Controlled technical information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

Covered contractor information system means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.

Covered defense information means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is--

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

Forensic analysis means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Malicious software means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

Media means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

Operationally critical support means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

Rapidly report means within 72 hours of discovery of any cyber incident.

Technical information means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems.

To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of an information technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in…